IRDAI cybersecurity and AI governance for insurance: the regulatory bar keeps rising

Board-level cybersecurity governance and CISO independence

ICS Guidelines, 2023 & Corporate Governance Regulations, 2024. The Board of Directors holds ultimate responsibility for information security and must approve the Information and Cyber Security Policy annually. A dedicated Chief Information Security Officer (CISO) must have direct access to the Board and CEO, establishing structural independence from operational IT teams. The Information Security Risk Management Committee (ISRMC), comprising the CTO, CISO, CRO, CSO, and CHRO, must meet at least twice annually and develop a three-year cybersecurity roadmap. A separate Risk Management Committee, chaired by an independent director, must meet at least four times per year.

→ Nexovern provides the continuous, correlated telemetry that boards and CISOs need for informed oversight, covering every AI system's runtime behavior, data access patterns, and policy adherence across the organization.

Six-hour incident reporting to IRDAI and CERT-In

ICS Guidelines, 2023 & Cyber Crisis Preparedness Circular, March 2025. All cyber incidents must be reported to both IRDAI and CERT-In within six hours of detection. Policyholder notification is mandatory for personal data breaches, with a 72-hour notification window under the DPDP Act. Entities must pre-empanel certified forensic experts to investigate incidents immediately. A conflict-of-interest safeguard prohibits organizations from conducting their own forensic investigations after identifying cyber risks. All system clocks must be synchronized with India's official NTP servers for forensic accuracy.

→ When an incident involves AI systems, Nexovern's prompt-level and OS-layer telemetry answers "what data was accessed, by which agent, and when" within the six-hour reporting window, replacing forensic guesswork with correlated evidence.

Data localization and 180-day log retention

Maintenance of Information Regulations, 2025. All ICT infrastructure logs, critical data, and business data must be stored on servers physically located in India. ICT and application logs require a continuous 180-day rolling retention period within Indian jurisdiction. When activities are outsourced to service providers outside India, all original policyholder records must continue to be maintained domestically. Cloud services are permitted only if customer data is encrypted, the cloud provider meets IRDAI-acceptable security standards, and the insurer retains full control and auditability.

→ Nexovern's monitoring identifies which AI agents send data to external endpoints, providing the visibility needed to verify that data localization requirements are met and that no AI workflow routes policyholder data outside Indian jurisdiction.

Annual cybersecurity audits across 24 security domains

ICS Guidelines, 2023. Independent cybersecurity audits covering all 24 security domains are mandatory every year. Audit reports must include findings summaries, non-compliance areas, risk ratings, and compliance checklists. Submission is due within 90 days after financial year-end or 30 days from audit completion, whichever is earlier. The 24 domains span data classification, access control, asset management, cryptographic controls, cloud security, incident management, business continuity, third-party provider management, mobile security, remote work, and monitoring and logging, among others.

→ Nexovern's continuous runtime records feed directly into annual audit engagements, providing auditors with correlated evidence of AI system behavior, access patterns, and control effectiveness across the 24 security domains.

AI governance: explainability, manual review, and outsourcing restrictions

DPDP Act, 2023 & Policyholders' Regulations, 2024. Under the DPDP Act, individuals affected by automated decisions have a right to explanation and a right to manual review. Under the Policyholders' Regulations, underwriting and claims decision-making functions cannot be outsourced, meaning AI systems making these decisions must operate under the insurer's direct governance. The AI Governance Working Group is designing pre-deployment validation and post-deployment monitoring requirements that will formalize accountability when automated systems produce errors in claims outcomes, fraud flags, or underwriting decisions.

→ Nexovern captures the full decision path for every AI-driven underwriting and claims interaction, providing the evidence trail that explainability requirements demand and supporting manual review processes with complete context.

DPDP Act alignment: consent, purpose limitation, and breach notification

DPDP Act, 2023 & Regulatory Sandbox Regulations, 2025. IRDAI's Regulatory Sandbox 2025 explicitly mandates DPDP Act compliance as a prerequisite for sandbox approval. Insurers must obtain explicit, informed consent before data collection or processing. Data may be collected only for specific purposes, and secondary use requires fresh consent. AI training data must be collected with appropriate consent. All data used by AI systems, including model outputs and decision logs, must be stored in India, and customer data processed by AI must be encrypted.

→ Nexovern's session-level records show whether each AI agent processed data only for the consented purpose, providing the evidence trail that purpose limitation and DPDP alignment demand.